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Please replace the paragraph beginning on page 7, line 4 with the following rewritten 
graph: 




7^ 



Please replace the; paragraph beginning on page 8, line 24 with die following rewritten 

r 

paragraph: ! 



The accounting process 14 also includes a flow aggregation processor 60 that is part of 
the aggregation and distribution process 17 (mentioned above). The flow aggregation processor 
60 is a central collection point for all network accounting records (NARs) produced from various 
data collectors 52a-52g in the flow data collection layer 18. The flow aggregation processor 60 
receives NARs from various data collectors 52a-52g and aggregates, i.e., summarizes related 
information from the received NARs across the accounting support arrangement 10. The 
aggregation processor 60[ produces Summary NARs i.e., enhanced and unique network 
accounting records. That is, the flow aggregation process aggregates the records across the 
network devices; whereas, individual data collectors 52a-52g can aggregate accounting records 
from individual data sources. Aggregation will be described below in FIGS. 14-23.--. 



Please replace the paragraph on beginning on page 10, line 2 with the following rewritten 
\y paragraph: 



As shown in FIG. 3, for the Internet service provider, data collectors 52a-52d (illustrated 
in Fig. 2) are distributed at specific Points of Presence (POP), such as remote access 
concentrators 102 managed by the Internet service provider. The remote access concentrators 



-trr 



Referring now to PIG. 2, the equipment interface layer 16 of the accounting process 14 
includes various equipment interfaces 42a-42c which are, respectively, an interface 42a for the 
router/switch 12a, an interface 42b for the cable/modem head end 12b, and an interface 42c for 
the flow probe 12c. The equipment interface layer 16 also includes additional interfaces such as 
an interface 42d for a remote access concentrator 12d, an interface 42e for an Extranet switch 
12e, sd interface 42f for a DNS server 12f, and an interface 42g for a RADIUS server 12g....The 
equipment interface can have additional interfaces that can be specified, as new equipment is 
added. The interfaces 42a-42g can be developed by an interface toolkit 44. The interface toolkit 
44 permits a user to cousthict a new equipment interface type to couple the accounting process 
1 4 to a new equipment source type.—. . 
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allow a mobile Internet user 106 ot an Internet user 107 with remote access to access an 
enterprise over the Internet, via the Internet service provider. In this example, the Internet 
service provider arrangement 100 and the large Enterprise arrangements 1 10 and 120 include 
servers 13, 13', and 13" Hurt run accounting processes 14, 14* and 14". The accounting 
processes 14, 14' and 14"! each independently manage and collect information regarding 
network traffic usage--, j - 



Please replace the paragraph begmmng on page 12, line 8 with the following rewritten 
paragraph: 



Referring now to i f IG. 4, a similar access configuration 100', as the configuration 100 
(FIG. 3) can be used with! an Extranet switch 122. Extranet access allows remote users to dial 
into an Internet service piWder (ISP) and reach a corporate or branch office via an ISP. The 
Extranet switch 122 allocs Internet users access to corporate databases, mail servers and file 
servers, for example. It is an extension of the Internet in combination with a corporate Intranet. 

> 

In this configuration, the .Extranet switch 122 can be owned and operated by an Internet service 
provider as shown with eiiterprise A, or it could, alternatively, be owned and operated by an 
enterprise, as shown withj enterprise B- Users would access the corporate network of either 
enterprise A or enterprise. B, via the Internet service provider with various types of tunneling 
protocols such as Layer 2 Tunneling Protocol (L2TP), Layer 2 Forwarding (L2F), Point to Point 
Tunneling Protocol (PPTtP) or Internet Protocol Security (IPSec), and so forth- The accounting 
server 13 located at the service provider and also accounting servers 13', 13" within enterprise A 
and enterprise B allow each the Internet service provider and each of enterprises A and B to run 
accounting process 14*, 14" on the servers 13% 13" to monitor and collect network data.--. 
fT 

Please replace the paragraph beginning on page 13, line 1 with the following rewritten 
paragraph: ^ 
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Referring now to FIG. 5, a graph 140 depiction of a very large scale network includes a 
device "A" 142 communicating with a device "B n 144. The graph 140 includes nodes (not all 
numbered) that can represent routers, switches, flow probes, etc. that have interfaces (not shown) 
which maintain statistics on information passed through the interfaces. For example, a switch 
may have a number of Ethernet ports and a host couJd be connected to one of the ports and in 



Received from < 919 654 4521 > at 2/12/03 4:35:10 PM [Eastern Standard Time] 



WITHROW & T E RRAN OVA 



@1005 



communication with one of the interfaces to transfer information over the network. The 
interface would have couriers that are used to track "packets in," "packets out," "bytes in," 
"bytes out," and so forth.-}- — 



Please replace the paragraph beginning on page 1 3, line 1 2 with the following rewritten 
paragraph: 




In this case of the host connected to the port, or a router or some other device being 
connected to the port, there is no other connection that the host, router or other device is aware of 
other than the entire network. This is an example of a "connectionless oriented" protocol. A 
data collector 52 can be disposed in the network in a path between the entities "A" and "B", such 

i 

that the data collector 52 monitors some of the packets that comprise a flow between "A" and 
"B." As a single point monitor, the data collector 52 has no concept that there are two ends 
communicating. The data collector 52 identifies these entities "A" and "B" in various NARs 
produced by the data collector 52. At a later stage in the processing, either in the data collector 
52 or elsewhere in the accounting process 14 the NARs are correlated so that the NARs or some 
aggregated NAR produced by the data collector 52 or the rest of the accounting process 14 can 
be associated with the accountable entities "A" and "B" to thus identify a connection between 
entities "A" and "B."— . 
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Please replace the! paragraph beginning on page 14, line 23 with the following rewritten 
paragraph: J 



Thus, the data collector 52 is a single point monitor that monitors traffic at one 
point in the network and 'converts the traffic into tf pipe oriented" or "flow oriented" accounting 
infoimation. The data collector 52 identifies a source and a destination of the traffic. That is, the 
data collector 52 develops? a "connection oriented tracking." By distributing data collectors 52a- 
52g (FIG. 2) throughout the network, the network can be modeled as pipes having two endpoints. 
A data collector can be disposed in a partial pipe. The data collector 52 determines that one end 
of the pipe refers to "A ,? sind the other end of the pipe refers to "B " The data collector 52 can be 
disposed anywhere along the network.—. 
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Please replace the paragraph beginning on page 15, line 13 with the following rewritten 

paragraph: ; — 

Some equipment hiive a half pipe model that generates independent accounting records 
for each half pipe. The daLa collectors can assemble full pipe information from half pipe 
information. The accounting process 14 could be coupled to equipment that gives a half pipe 
model for A communicating with B and a separate one for B communicating with A. The data 
collectors 52a-52g co mbine information from these two half pipes into a bi directional flow.-. 

Please replace the paragraph beginning on page 1 5, line 21 with the following rewritten 

paragraph: i , — 

Referring now to FIG. 6, an example of data flow 130 through the accounting process 14 
is shown. In this example, the data flow 130 is initiated by a user 131 making a call to a remote 
access concentrator (RAG) 132. Upon receiving the call, the RAC 132 authenticates the user 
131 against a secure access controller 134. After verification, the RAC 132 connects the user 
131 to the network 135 aid sends a RADIUS Start record (not shown) to the accounting process 
14. The accounting process 14 generates a RADIUS Start NAR 137a and stores the RADIUS 
Start NAR 137a in a database 62. At that point, the remote user may check e-mail, look at a web 
server and transfer a file. I For each transaction, the accounting process 14 captures the IP traffic, 
generating e-mail, http, aiid ftp network accounting records 137b-137d, respectively. These are 
stored in the database 62] Upon completion of these transactions the user would log out of the 
network, at which time the RAC 132 would send the accounting process 14 a RADIUS Stop 
record. The accounting process 14 generates a RADUIS Stop NAR 137e and stores the 
RADIUS Stop NAR 137e in the database 62. All of these records reflecting the user's 
transactions could be viewed and reported in flexible ways dependent on the needs of an end- 
. user application.-. 



Please replace the paragraph beginning on page 16, line 27 with the following rewritten 
paragraph: 

FIG. 7 has a plurality of exclusively "Activity NARs" which could correspond to a very 
low level of detail, or could be the result of a prior aggregation providing a higher level view of 
the information. Thus, FIG- 7 shows a collection 152 of exclusively activity NARs. From base 
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level data, additional "views" of the NAR could be produced, such as a set of "Summary NARs" ^ 
154, or another set of Activity NARs 156 which could be a result of further aggregation of the ^ 
base level information, or jiastly a combination of a set of Summary NARs and Activity NARs £ 
158. The summary NAR js produced by the central aggregation processor 60 and can include 
user identifying information, protocol information, connection time information, data 

information, and so forth.—. ^ 

Please replace the paragraph begiiniiiig on page 21 , line 1 3 with the following rewritten ^ 
paragraph: 



The plurality of Network Accounting Record Attributes 204a-204n provide metrics for 
the NAR 200. The Network Accounting Record Attributes 204a-204n capture specific 
information contained in data from network devices. Differentiating between the Network 
Accounting Recoid Identifier 202 and the metric 204 allows the accounting process 14 to 
perform logical and arithmetical operations on metrics 204 while leaving the Network 
Accounting Record Identifier 202 intact. The Network Accounting Record Identifier 202 can be 
enhanced unlike the metrics 204.—. 

. — — r ■ ~~ 

I 

Please replace theparagraph beginning on page 21, line 22 with the following rewritten 
paragraph: 

- The data collectors 52a-52g (FIG. 2) are oriented around the process of filling in the 

i 

NAR- The metrics are left untouched by the data collector and are passed transparently into the 
accounting process flow aggregation processor 60. The data collectors 52a-52g assign the 
Network Accounting Record Identifiers 202 to the metrics e.g,, a source and a destination 
identifier to the metric. In the example of a router link, the metrics that the router interface 
provides are in the form of "information in" and 'information out" e.g., octets in, octets out, 
bytes in, bytes out, datagrams in, datagrams out, faults in, faults out, and so forth. The data 
collectors 52a-52g determine what "in" and "out* * mean and assigns the unique identifier that is 
unambiguous relative to the determined meaning of "in" and "out" Once a data collector 52 has 
established this convention, the convention is used throughout the system 10.—. 
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Please replace the paragraph beginniDg on page 33, line 17 with the following rewritten 
paragraph: 




Referring now to ijlG. 15, a data collection process 330 performed by the flow data 
collector 52 of FIG. 17 is shown. The flow data collector receives 332 data from the equipment 
; interface for a network device. The flow data collector performs an equipment interface specific 
translation to convert 336|the received data into NAR format as well as populates the NAR 
header. Once the NAR islpopulated with the appropriate data, the flow data collector 52 
attempts to correlate 338 the newly populated NAR with the other NARs. That is, the flow data 
collector 52 compares thejnewly populated NAR to NARs currently stored in the local store 314 
(from FIG. 14) to determine if there are multiple instances of the same object. Specifically, 
correlation is performed riy examining the ACCT_ENTITY_ID (from FIGS. 11A-UE).~. 



Please replace thejparagraph beginning on page 37, line 27 with the following rewritten 



^ paragraph: 



The flow aggregation processor (FAP) 60 (FIG. 2) aggregates and/or enhances record 
data across the system 10|. It receives data from multiple flow data collectors (FDCs) that may 
be aggregating and enhancing close to the source of the information (as described above with 
reference to FIG. 1 7). As NARs are received from multiple FDCs, the data can be further 
enhanced and/or reducedj(i.e. aggregated) to meet the specific needs of an application or output 
interface based on the aggregation policy of the flow aggregation processor 60 (FAP). The 
design and operation of the FAP will be described in more detail below.-. 
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Please replace the paragraph beginning on page 41, line 6 with the following rewritten 



paragraph: 



U1 



- These two records NAR1, NAR2 are combined through correlation 442 (from FIG. 17) 
and enhancement 444 (FIG. 17) to generate an enhanced NAR2 532. This enhanced NAR has a 
modified accountable entity identifier 534 and a metric. The modified accountable entity 
identifier is the existing accounting entity ID 514, to which the FAP has added the IP-to- 
usemame assignment from the accounting entity ID 512 of the NAR1 508.—. 
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Please replace thd paragraph beginning on page 49, line 20 with the following rewritten 
paragraph: — 



Please replace the paragraph beginning on page 41 . line 13 with the following rewritten gj 

ni 

paragraph: j €/) — 

1 Still referring to fJg. 18, the NARl 508 has an IP-to-usemame mapping 5 12 and an H 

accounting interval 516 comprising a start time and a session time to indicate atime interval < 

bounded by start time "Tlf and a start time + session time ("T2"), that is, the accounting interval == 

represents a start time and' a stop time. The username 524 in the IP address-to-usemame g 

mapping is supplied by the DHCP server 500. In ike FAP, this NARl information will either go JJ^ 

directly to a correlation fuaction or to the local store (which could either be a database, file or q 

memory), where it can beidirectly accessed by the correlator function. The NAR2 510 has an O 

accounting entity ID 5 14 Ja T3-to-T4 accounting time interval 5 1 8 and a metric 530. The -< 
accounting entity identifier 514 has two IP addresses 526, 528, one corresponding to a source IP 
address and the other conjssponding to a destination IP address. The NAR2 510 is passed to the 
correlator 442, which determines that the Tl-to-T2 time interval 516 from the IP-to-username 
address map in the NARl! 508 overlaps or in some way relates to tbe T3-to-T4 time interval 518 
of the NAR2 510. The correlator 442 determines that Tl, T2, T3 and T4 are related, and that the 

t 

IP address 522 in the IP-tp-username address mapping 512 is associated with one of the two IP 
addresses 526, 528 in thejNAR2 510. Thus, the FAP enhances the NAR2 510 by inserting 
information from the accounting entity ID 512 (of NARl 508) into the accounting entity ID 
portion of the NAR2 510. The resulting, enhanced NAR2 532 has an enhanced accounting entity 
ID 534 that includes the f3-to-T4 timestamp (not shown), the IP-to-IP addresses 526, 528 and 
the username 524. Thus,jthe enhanced NAR2 now has a mapping between the usemame and the 
one of the IP addresses 526, 528 that is related to the IP address 522. The metric 530 is 
unchanged-— j 




As discussed above in reference to FIG. 2, the accounting process supports a flow probe 
e.g., 12c that captures a user's network activity for purposes of TP accounting. The flow probe 
12c monitors all traffic over a given network link and captures data associated with the different 
flows in the traffic on that link. It is capable of monitoring IP data flows over a number of 
technologies (e.g., Ethernet, Asynchronous Transfer Mode (ATM), FDDI, etc.).—. 
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Please replace the paragraph beginning on page 51, line 9 with the following rewritten 



paragraph: 



CD 
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Generally, a flow defined as any communication between communicating entities 
identified by an IP address, a protocol and a service port. All IP packets (or datagrams) are 
categorized using the fields present in the packets themselves: source/destination IP addresses, 
the protocol indicated in tiie IP header PROTO field, and, in the case of User Datagram Protocol 
(UDP) or Transmission Cpntrol Protocol (TCP), by the packet's source and destination port 

I 

numbers.—. '* 
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Please replace the paragraph beginning on page 58, line 20 with the following rewritten 
paragraph: ; 



- The flow probe reports on network traffic activity through a flow probe NAR, which 
reports IP flow traffic activity. The flow probe categorizes network traffic into one of four 
classes of traffic flow: i) connection oriented (e.g., TCP); ii) new connectionless; iii) 
request/response connectionless (e.g., User Datagram Protocol (UDP), Domain Name System 
(DNS)); and iv) connectionless persistent (e.g., Network File System (NFS), Multicast 
BackBONE, or "MBONE" multicast traffic). To each of these classes it applies connection 
oriented semantics for a iniform approach to status reporting. That is, the flow probe treats these 
dissimilar transaction models as if they were the same. There is one uniform structure for the 
status reports generated fpr each of the 4 different transactions. Each status report includes 
transaction start and stoplinformation, media access control (MAC) and IP source and destination 
addresses, the IP options jthat were seen, the upper layer protocol used, and the transaction source 
and destination byte and packet counts and upper layer protocol specific information. The 
protocol specific information and the criteria for when the status reports are created is different 
for each of the four transaction types.—. 



Please replace the paragraph beginning on page 63, line 23 with the following rewritten 
paragraph: 



— For some protocols that permit wrap around, the packet loss detector process 704 tests 
1^ Qj)^ 71 8 if the sequence number has wrapped around e.g., gone fiom 32 bits of all ones to 32 bits of 
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all zeros. The IPSec Authentication packets currently do not permit wrap around, so test 718 CD 

would not be necessary foi IPSec Authentication Headers, If for other protocols (or latter CO 

versions of the IPSec Authentication protocol), the packet loss detector process 704 detects a ^ 

wrap around condition, then there has not been any packet loss and the packet is dropped. The ^ 

packet loss detector process 704 will update 712 the stored sequence number for that flow in the j= 
cache. If the sequence nujnber is any other number, i.e., it did not turn over to all zeros, then 

there may have been packU loss. If there may have been packet loss, the packet loss detector Jn 

process 704 can determim; how many packets have been lost by determining how many sequence O 

, numbers are missing.--. | "D 

— ! " < 




Please replace thejparagraph beginning on page 66, line 1 5 with the following rewritten 
paragraph: / j , . 

An important component of quality of service incl udes determining whether there has 
been packet loss. The packet detector monitor described in conjunction with FIGS, 29 A and 29B 
can be used to access packet loss. The packet detection monitor 702 can be deployed in the 
network and generate N^Rs that can be used to determine packet loss as discussed above. This 
information can be used in the capturing quality of service process 730 to assess whether the 
policy specified by the se rvice level agreement was provided to the customer. Additionally, so 
called Differentiated Service ce DiffServ technology" that a known quality of service solution that 
has been proposed for the Internet as well as enterprise networks. In contrast to a per-flow 
orientation of some types! of quality of service solutions such as Integrated Services (Int-serv) 
and Resource Reservation Setup Protocol (RSVP), Diffserv enabled networks classify packets 
into one of a small number of aggregated flows or "classes", based on bits set in the type of 
service (TOS) field of each packet's IP header. This quality of service technology for IP 
networking is designed to lower the statistical probability of packet loss of specific flows. The 
capturing quality of service process 730 establishes DiffServ policy that is decomposed into a 
collection of DiffServ configurations. The DiffServ configurations are deployed to a collection 
of routers or switches that the customer would have access to in the network 1 1 as part of the 
enforcement/deployment process 732. Because packet loss is a statistical phenomenon, the 
capturing quality of service process 730 observes 736 a large number of network flows. The 
capturing quality of service process 730 can observe network traffic because of the use of the 



i 10 
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3 accounting process 14 and the resulting NARs at the granularity in which the DiffServ policies 
are actually being deployed The DiffServ policies are generally deployed at the source and 
destination IP address, prJtocol and possibly destination port level.-. 
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Please replace the paragraph beginning on page 68, line 19 with the following rewritten 
paragraph: ; 



I 




A service management feedback process 750 therefore includes three components, > 
service provisioning 752, policy server 754 and'service accounting 756. The role of service r 



| • : 

Please replace thej paragraph beginning on page 69, line 12 with the following rewritten 
paragraph: j _. 



— In addition, levels of service might change, and the system takes changes into account so 
that the service management can modify the charge or account differently for those changes in 
levels of service. The service accounting also use|S the active policy information from the policy 
server to deliver billing itiformation to a billing system or to a chargeback system that can make 
adjustments to billings for the service.--. 



Please replace the paragraph beginning on page 69, line 19 with the following rewritten 
paragraph: 
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provisioning 752 is to serti requests 752b to the policy server 754 to obtain an appropriate active 
policy, and to obtain rules and domain information 754a from the policy server. The Q 
provisioning system can (jommunicate with appropriate network management systems and 
element management systems (not shown) to configure the network 10 for an end-to-end service. 
When the configuration J r 52a is deployed at the various network devices (not shown), the service 
js produced. The level of service is monitored or audited by the accounting system 756 which 
can be the accounting prqcess 14 described above. The accounting process 14 monitors the leveJ 
of service by producing appropriate network accounting records. The network accounting 
records (NARs) are used ^y a billing application to adjust billing based on the level of service 
that was provided as determined by the accounting process 1 4. The accounting process 14 also 
can compare the policies produced by the policy server to the actual levels of service provided to 
the customer by examinmg NARs that are produced by the customer's usage of the network.--. 
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A policy server 754 is built on the capabilities of address management, domain name 
management and so forth, j Essentially in a policy cjnabled network, policy servers produce a set 
P Jrf 0 f rules and apply those njles to a domain or problem set. The policy server communicates the 
rules to the accounting process 14 so that the accounting process 14 can determine what kind of 
records to generate. All Jrthe information is described using data flows.-. 



Please replace the {paragraph beginning on page 69, line 27 with the following rewritten 
paragraph: i 



As an example, a service contract may specify that a company "X" will be given 1 UU% 
availability of a particular network device e.g., a router (not shown) and its corresponding 
service. In order to assurj* that level of service, the policy server 754 sends that requirement in a 
template to the provisioning service 752 to produce a configuration file 752a to configure the 
router to give company "X" preferred use of the router. Therefore, every time a packet from 
company u X'"s network comes across the router, the packet will always be transmitted unless 
there is something wrongjwith the router. This may occur even if a packet of company "Y", 
which has a lower service level that company "X"| S is waiting in the router to be transmitted. The 
packet from company "Yj' will wait because company "Y" is not paying for the quality of 
service that company "X? is paying for.--. j 
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Please replace th^ paragraph beginning ohipage 70, line 13 with the following rewritten 
paragraph: j j 




In that case, the provisioning service 752 configures the policy enforcement mechanism 

i j 

that was put into the router in the network. How the policy was defined to the provisioning 

equipment is that there is, a one-to-one relationship between the policy and what the accounting 

< | 
process 14 will monitor in the network. The accojunting process 14 will be aware that company 

"X" contracted to have 100% availability from the router.—. 



f ' 1 


Please replace thd paragraph beginning or 
paragraph: 


page 70, line 20 with the following rewritten 


ft - The accounting process 14 will then take < 
( » (/ 1 will construct an accounting record thai reflects tl 


svery source of information it has available and 
te level of service actually delivered to 
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company "X." The accounting records produced are relative to two components, i.e., the router 
and the customer. The accounting process 14 is flexible and can generate accounting records of 
any flow abstraction. In title service management feedback process 750, the policy server 754 
sends a flow based policy Sto the provisioning service 752. The provisioning service 752 uses a 
flow based policy to configure ihe network. That same flow based policy is passed to the 
accounting process 14, wljich can generate NARs having metrics that can be used to match the 
same level of those flows] The output of the accounting process 14 will determine whether the 
quality of service, availability, etc. that was contracted for in the contract 751 was provided. 
Therefore, the service maiiagement feedback process 750 provides the level of service that was 
delivered at the same semantic level as the actual contract.-. 

Please replace thejparagraph beginning on page 71, line 9 with the following rewritten 
paragraph: 
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capturing quality of service as audited by the accounting process 14 includes detecting 
packet loss, as uieutionedjabove. Each of the components managed by the service management 
feedback process 750 requires information. Therefore, the provisioning service 752 has to 
provision these various quality levels. The policy server 754, thus, keeps what is essentially 
enforcement of the levelsj of quality that are offered by different service types, and the 
accounting process 756 dfetects, monitors and audits whether those classes it) quality of service 

are being delivered.-, j 

i ■ 
i 

j /• 
Please replace thd paragraph beginning on page 71, line 1 9 with the following rewritten 
paragraph: 




Referring to FIG. ; 32, an implementation of the provisioning service 752 is shown. The 

! 

provisioning service 752 .extends concepts of device management and network management into 
a service management layer of functionality. The provisioning service 752 includes a 
provisioning core 782, provisioning modules 784, and element managers 786. The provisioning 
service 752 is user focused rather than network focused, as in conventional network 
management. Network management involves communication with network systems and 
equipment. The provisioning service 752 is oriented more towards a user and a user's concepts 
of services. The provisioning service 752 provides an additional layer of abstraction that relates 
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the description of services at a user level to a network's ability to provide those end-to-end 
services. The architecture 780 of provisioning service 752 is a multi-device 788 at the bottom of 
the architecture and raultijservice 790 at the top of the architecture. The provisioning service 
752 is deployed to write commands to the network systems, i.e., multi-devices 788 in order to 
change the configurations! of those systems.—. 



Please replace the[paragraph beginning on page 72, line 9 with the following rewritten 
paragraph: • 
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- Since many end customer services now require that a network operate with multiple 
kinds of network elements in order to provide an end-to-end service, the provisioning service 
752 simplifies producing [information that is necessary for a service provider to translate a 
service order from a customer to a network configuration, i.e., all commands necessary for all the 
different elements in the network in order to create an end-to-end service.-. 



m 

o 
O 

«< 



Please replace thejparagraph beginning on page 72, line 1 7 with the following rewritten 
paragraph: I 



The provisioning ^service 752 builds on existing systems. That is, in the lower layers 
there are existing elemenl managers that have a configuration management system to configure 
^ at the network layer. Thi provisioning service 752 adds layering over the conventional network 

management layer. The provisioning service 752 maps a customer specified end-to-end service 

i 

to the network elements tfiat are required to produce that end-to-end service. Mapping of a 
customer's service order|; into the state of the network can have various pieces of workflow 
necessary to create or completely activate this service order.™. 



In the claims: 

Please amend claims 1 as follows: 



1 . (twice amended) A method of transmitting accounting records in an accounting system tbat 

i 

produces information pertaining to network traffic flow comprising: 

collecting data from a network device by a data collector associated with the network 
device and producing accounting records from the data; 
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transmitting the amounting records to first and second flow aggregation processes, with 

transmitting further comprising for each flow aggregation process: 

storing in the data collector the accounting records; 

• transmitting the accounting records to the flow aggregation process; and 

awaiting ai acknowledgment signal from the flow aggregation process that the 

flow aggregation process bceived the accounting records before discarding the accounting 

i 

records sent to the flow aggregation process. . 



Attached is a marf :ed-up version of the amendments made to the application by the 
current response. The attachment is captioned "VERSION WITH MARKINGS TO SHOW 
CHANGES MADE." j 
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